Can I tail the log on a Cisco Router?

Question

Can I tail the log on a Cisco Router? I have 'logging buffered 51200' and a debug running. I can see the packets with 'show log'. Can I tail this?

Solution 1

Sure, run logging monitor debug (or any other level) then terminal monitor.
Log will be displayed on your (and only your) Telnet/SSH session.
If you are connected using the console port, use logging console.

This will enable a behaviour similar to tail -f.

Solution 2

Sending to syslog is the better way to do, but here's a trick you might find useful:

You can do "show logging | begin regexp" and it will show you the log starting at any lines matching that regexp.

That way, if you have your logs being time-stamped (you do, right?) You can something like:

show logging | begin ^Sep 3*

(note there is a double space after "Sep" but this text editor eats it) and it will show you all logs starting from September 3rd, for example.

Requires some experimentation to get it right. :)

Solution 3

The best way to do this is to set a syslog host and by sending data log to it you can watch events in realtime. You could also try adjusting the console messages with logging console debug

Comments

[Admin]

If you need to jump quickly to the last lines of the log, term length 0 before sh log.

[radius]

To clarify a bit, "logging monitor <level>" set globally the level, then "terminal monitor" enable session per session to display log on the terminal (using the globally defined level).